fix(map): stop using OpenStreetMap's volunteer tile servers

OSM blocked OpsLog and every user's map filled with "Access blocked / 403"
tiles at once. Their policy is explicit: an application must identify itself
with a proper, unique User-Agent on every tile request. A program that draws
its maps inside a web view cannot do that — the browser sets that header and
Leaflet fetches tiles as plain <img> loads — so this is not something to tune,
it is a service we are not entitled to use.

Two layers still pointed there: the Street basemap and the locator map. Street
moves to Esri World Street Map, the locator map to Carto, both key-free and
both under terms that cover a redistributed application. OpenStreetMap keeps
its credit: Carto's tiles are built from OSM data.

The locator map also gains the tile restraint the world map already had —
updateWhenIdle, no fetching mid-zoom, one ring of buffer. Fetching as fast as
the pointer moves is another item on OSM's block list, and the replacement
providers are under no more obligation to tolerate it than OSM was.

The basemap preference key is untouched, so an operator who had picked "Street"
still gets a street map, from the new source.

frontend/src/components/MainMap.tsx

@@ -43,9 +43,20 @@ function unwrapLon(ring: [number, number][]): [number, number][] {
 }
 
 const CARTO_LIGHT = 'https://{s}.basemaps.cartocdn.com/light_all/{z}/{x}/{y}{r}.png';
-const OSM = 'https://{s}.tile.openstreetmap.org/{z}/{x}/{y}.png';
 const CARTO_ATTR = '© OpenStreetMap © CARTO';
-const OSM_ATTR = '© OpenStreetMap contributors';
+
+// NOT tile.openstreetmap.org. Those are OpenStreetMap's VOLUNTEER-run servers,
+// and their usage policy does not cover a desktop application handed to an
+// unbounded number of operators — they blocked OpsLog for it, and every user's
+// map filled with "Access blocked / 403" tiles at once.
+//
+// The replacements are tile services whose terms do cover redistributed apps,
+// with no API key: Carto (whose tiles are OSM-derived, hence the attribution
+// still credits OpenStreetMap) and Esri. Anything added here later must be
+// checked the same way — a free tile URL is not the same thing as a tile URL we
+// are allowed to ship.
+const ESRI_STREET = 'https://server.arcgisonline.com/ArcGIS/rest/services/World_Street_Map/MapServer/tile/{z}/{y}/{x}';
+const ESRI_STREET_ATTR = 'Tiles © Esri — Source: Esri, HERE, Garmin, © OpenStreetMap contributors';
 
 // Selectable basemaps for the world (great-circle) map. All key-free and all
 // LABELLED (country/continent names). `labelsUrl` adds a transparent place-name
@@ -55,7 +66,7 @@ const BASEMAPS: Record<BasemapKey, { label: string; url: string; attr: string; s
   light:     { label: 'Light',     url: CARTO_LIGHT, attr: CARTO_ATTR, subdomains: 'abcd' },
   voyager:   { label: 'Voyager',   url: 'https://{s}.basemaps.cartocdn.com/rastertiles/voyager/{z}/{x}/{y}{r}.png',
                attr: CARTO_ATTR, subdomains: 'abcd' },
-  street:    { label: 'Street',    url: OSM, attr: OSM_ATTR },
+  street:    { label: 'Street',    url: ESRI_STREET, attr: ESRI_STREET_ATTR },
   satellite: { label: 'Satellite', url: 'https://server.arcgisonline.com/ArcGIS/rest/services/World_Imagery/MapServer/tile/{z}/{y}/{x}',
                attr: 'Tiles &copy; Esri — Source: Esri, Maxar, Earthstar Geographics',
                labelsUrl: 'https://server.arcgisonline.com/ArcGIS/rest/services/Reference/World_Boundaries_and_Places/MapServer/tile/{z}/{y}/{x}' },
@@ -416,7 +427,14 @@ export function LocatorMap({ toGrid, toLabel }: LocatorProps) {
     if (locatorRef.current && !locatorMap.current) {
       const m = L.map(locatorRef.current, { zoomControl: true, attributionControl: true })
         .setView([20, 0], 2);
-      L.tileLayer(OSM, { attribution: OSM_ATTR, maxZoom: 19 }).addTo(m);
+      // Same restraint as the world map: fetch on idle, not mid-pan, and keep a
+      // single ring of buffer tiles. Requesting tiles as fast as the pointer
+      // moves is what gets an app blocked, and the next provider is under no
+      // more obligation to tolerate it than the last one was.
+      L.tileLayer(CARTO_LIGHT, {
+        attribution: CARTO_ATTR, subdomains: 'abcd', maxZoom: 19,
+        updateWhenIdle: true, updateWhenZooming: false, keepBuffer: 1,
+      }).addTo(m);
       locatorOverlay.current = L.layerGroup().addTo(m);
       locatorMap.current = m;
     }